Of course if one gets a lot, it could be a problem, one solution I use
is putting this type (once the
domain is confirmed and some whois data as well as who owns he IP
address space) in the badmailfrom
of qmail. Stearns Blacklist (if it wasn't so huge) stops a bunch of
this at connection time.
Internal RBL's can be helpful also, basically stop these, although, this
either requires programming to
automate, or human intervention to maintain. This type, for me I just
stop at the session level.
I have found (lately) most come from a particular geographic region,
this may only be a trend,
but, that may be trackable.
John D. Hardin wrote:
On Wed, 27 Sep 2006, Peter Smith wrote:
The messages are simply a random stream of words, with punctuation
scattered in them. No HTML, no URLs being advertised, no excessive
capitalisation, just meaningless text.
Technically, then, it's not spam. Spam requires a commercial message
of some sort. :)
As such, SA is finding very little to complain about, and is even
lowering the scoring because the bayes filtering deems it to be
good.
I'm torn about whether or not to train on such messages. I do hand
training so I keep pretty tight control over what gets trained.
I would agree that it's an attempt to poison your bayes database,
assuming that you have autolearn turned on, either by skewing the
scores towards ham or by bloating the database.
Any thoughts on what I can do about these messages? Even with
bayes turned off, they would still fail to score more than say 2
or 3. Each message contains a different paragraph of random text,
so it's not possible to pick out keywords; and the messages are
coming from dialup machines, so blocking IP isn't going to be very
effective.
Look for punctuation? A good deal of the random bayes poison at one
time was totally without punctuation.
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
[EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED]
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...every time I sit down in front of a Windows machine I feel as
if the computer is just a place for the manufacturers to put their
advertising. -- fwadling on Y! SCOX
----------------------------------------------------------------------
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
